PT-2002-2668 · Webmin · Webmin

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-1947

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Webmin versions 0.21 through 1.0

Description The issue allows remote attackers to eavesdrop or hijack the SSL session due to the use of the same built-in SSL key for all installations.

Recommendations For versions 0.21 through 1.0, consider regenerating a unique SSL key for each installation to prevent session hijacking.

Fix

Related Identifiers

CVE-2002-1947

Affected Products

Webmin

References · 5

• http://iss.net/security_center/static/10381.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2002-1947 · Security Note
• http://securityfocus.com/bid/5936 · Patch
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A06.asc · Vendor Advisory
• http://webmin.com/changes.html · Note